<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<head th:replace="~{common/common::head}"></head>
<body>
<div class="layuimini-container">
    <div class="layuimini-main">
        <div class="layui-row layui-col-space15">
            <div class="layui-col-md12">
                <fieldset class="layui-elem-field layui-field-title">
                    <legend style="color: rgb(30 159 255)">任意文件操作 - 文件删除</legend>
                    <blockquote class="layui-elem-quote layui-quote-nm"
                                style="font-size: 15px;background-color: #a7deefab;box-shadow: 0 .125rem .25rem rgba(0, 0, 0, .075) !important">
                        <p>
                        <pre>  任意文件删除：攻击者在系统中删除任何文件，可能导致数据丢失或系统崩溃</pre>
                        </p>
                    </blockquote>
                </fieldset>
            </div>

            <div class="layui-col-md12" style="margin-top: 10px">
                <div class="layui-row layui-col-space15">
                    <div class="layui-col-md6">
                        <h1 style="display: flex; justify-content: space-between; align-items: center;height: 33.5px">
                            <span class="iconfont icon-bug"> 漏洞场景：ProcessBuilder</span>
                            <span class="iconfont icon-liuliang1">
                                <a href="/other/datapackage/file/delete.pcapng" download="delete.pcapng"
                                   style="margin-right: 19px;color: #00bb00">流量分析</a>
                            </span>
                        </h1>
                        <div class="layui-tab layui-tab-brief">

                            <div class="layui-tab-content">
                                <div class="layui-tab-item layui-show">
                                    <blockquote class="layui-elem-quote main_btn">
                                        <p>文件路径没做限制，可使用../遍历删除任意文件</p>
                                        <a target="_blank" href="/file/delete/vul?filePath=./src/main/resources/static/upload/demo.txt">
                                            <button class="layui-btn layui-btn-normal" style="width: 100px; margin-left: 10px;">
                                                <span class="iconfont icon-zhihang">Run</span>
                                            </button>
                                        </a>
                                    </blockquote>
                                </div>

                                <div class="layui-col-md12">
                                    <div class="layui-card">
                                        <div class="layui-card-header"><i class="fa fa-bullhorn icon-tip"></i>tips</div>
                                        <div class="layui-card-body layui-text layadmin-text">
                                            <pre style="color: #28333e;font-size: 15px;">
当然，在实际做文件删除测试中，还是要谨慎些，避免造成不可逆的影响
                                            </pre>
                                        </div>
                                    </div>
                                </div>


                            </div>
                        </div>
                    </div>

                    <div class="layui-col-md6">
                        <h1 style="display: flex; align-items: center; height: 33.5px;">
                            <span class="iconfont icon-code" style="height: 22.5px;">缺陷代码</span>
                        </h1>
                        <div class="m-auto div-shadow shadow p-3 mb-5 bg-white rounded">
                            <div class="code-editor" id="deleteFile">
                            </div>
                        </div>
                    </div>
                </div>
            </div>

            <div class="layui-col-md12" style="margin-top: 10px">
                <div class="layui-row layui-col-space15">
                    <div class="layui-col-md6">
                        <h1><span class="iconfont icon-anquan">  安全场景：文件删除目录限制</span></h1>
                        <div class="layui-tab layui-tab-brief">

                            <div class="layui-tab-content">
                                <div class="layui-tab-item layui-show">
                                    <blockquote class="layui-elem-quote main_btn">
                                        <p>可尝试删除test.txt、text.jsp文件</p>
                                        <a target="_blank" href="/file/delete/safe?fileName=../test">
                                            <button class="layui-btn layui-btn-normal" style="width: 100px; margin-left: 10px;">
                                                <span class="iconfont icon-zhihang">Run</span>
                                            </button>
                                        </a>
                                    </blockquote>
                                </div>

                                <div class="layui-col-md12">
                                    <div class="layui-card">
                                        <div class="layui-card-header"><i class="fa fa-bullhorn icon-tip"></i>tips</div>
                                        <div class="layui-card-body layui-text layadmin-text">
                                            <pre style="color: #28333e;font-size: 15px;">安全编码建议：
    1、限制目录访问：将用户的文件操作限制在特定的安全目录内，确保所有路径操作都在该目录下进行。
    2、输入验证和清理：过滤用户输入，防止目录遍历攻击。禁止使用 ..、/、\ 等特殊字符。
    3、使用白名单策略：只允许符合安全规则的文件类型和格式被删除，限制文件扩展名。
    4、权限控制：设置文件和目录的访问权限，确保只有授权用户可以进行删除操作。</pre>
                                        </div>
                                    </div>
                                </div>
                            </div>
                        </div>
                    </div>

                    <div class="layui-col-md6">
                        <h1><span class="iconfont icon-code">  安全代码</span></h1>
                        <div class="m-auto div-shadow shadow p-3 mb-5 bg-white rounded">
                            <div class="code-editor" id="safeDeleteFile">
                            </div>
                        </div>
                    </div>
                </div>
            </div>
        </div>
    </div>
</div>

<div th:replace="~{common/common::script}"></div>
<script type="text/javascript">
    layui.use(['layer', 'miniTab', 'common', 'upload'], function () {
        var $ = layui.jquery,
            layer = layui.layer,
            miniTab = layui.miniTab;
        miniTab.listen();
        layer.msg("任意文件类-文件删除")

        var cmConfig = {
            lineNumbers: true,
            lineWrapping: false,
            indentUnit: 4,
            indentWithTabs: true,
            theme: 'juejin',
            styleActiveLine: {nonEmpty: true},
            fontSize: "18px",
            mode: "text/x-java"
        };

        var cmConfigSafe = {
            lineNumbers: true,
            lineWrapping: false,
            indentUnit: 4,
            indentWithTabs: true,
            theme: 'juejinsafe',
            styleActiveLine: {nonEmpty: true},
            fontSize: "18px",
            mode: "text/x-java"
        };

        CodeMirror(document.getElementById("deleteFile"), Object.assign({}, cmConfig, {
            value: deleteFile
        }));
        CodeMirror(document.getElementById("safeDeleteFile"), Object.assign({}, cmConfigSafe, {
            value: safeDeleteFile
        }));


    });
</script>

</body>
</html>
